Security and privacy

Grid Console runs on your machine and talks to the outside for six things, all listed here. The agent works with your own Claude Code permissions; this chapter says what Grid adds on top, what it refuses by name, and what it does not do yet.

The split

Grid keeps card state, stages, boards, memory files and the code index. The provider CLI runs the model, edits files and runs commands, signed in on its own account. Grid also spawns that same CLI on your account for its own small jobs: retitling, summaries, the decision chips, backlog refinement and the design chat. No model call, prompt or API key passes through gridconsole.dev.

What leaves the machine

Never: code, prompts, transcripts, file names, model keys. Activity reporting stores only the latest timestamp per signed-in device; it does not record clicks, keystrokes, windows, projects or session contents. Cards, plans and boards stay on disk as markdown and plain JSON; nothing syncs.

The daemon

gridd binds 127.0.0.1:6724, and for every route but one the loopback bind is the boundary. The exception is POST /api/shutdown, the route grid stop asks first: it wants the 32 random hex bytes the daemon mints at boot and writes to <GRID_HOME>/active-token, compared with timingSafeEqual, and it refuses outright any request carrying an Origin header at all, so the console's own page cannot reach it. Every route and the WebSocket handshake refuse a cross-origin request; a browser Origin must match the host, and a request with no Origin is treated as a local tool. Widening the host with GRID_HOST is possible and the daemon warns loudly, because anything that reaches it can drive your sessions.

What the agent may do

A card's agent runs with your own Claude Code permission mode, auto by default and set per project, passed as --permission-mode and a per-card settings file. There is no OS sandbox and no network allowlist. Installing packages and deleting files are allowed. Pushing is allowed, except to main, master, trunk, develop and the project's target branches on origin or upstream; a project whose delivery is set to no commits gets no push at all. What Grid denies by name:

Force pushes, gh pr merge and history rewrites are not denied by rule. The session instructions say to ask first, and Grid refuses to remember a "yes" for them, but that binds an honest agent only.

When Claude Code's auto mode refuses a call, or would show a permission dialog, the card does not stop: the call lands in your Queue with the exact command and the reason, and you answer Deny, Allow once, Allow for this card or Always for this project. An approval lets that exact call run, without your touching a terminal; a project-wide one is listed under Settings, Agent decisions, where you can take it back. Nothing you answer there lifts a row in the table above. A deploy command is asked the same way in every stage that is not set up to deploy. Your own allow rules from ~/.claude/settings.json ride along to every card, except write rules and any rule that looks like it holds a credential. grid project permissions <name> trusted, or AGENTS on the project's page, lets a project's agents run shell and web calls without the auto-mode classifier; the denied rows and the deploy question still apply.

Worktrees, seeds and redaction

A new worktree receives copies of .env, .env.*, *.pem, *.key and .claude/settings.local.json from the repo root, and of .env, .env.* and *.local.* files at any depth that your checkout's git ignores (never under node_modules, build output or .git, and none over 1 MiB). The seed key in grid.toml adds patterns per repo, and a pattern may nest (ios/*.xcconfig, **/*.local.json). Grid redacts what it stores about a card, the outcome text and the summaries: API keys, GitHub, GitLab and Slack tokens, AWS and Google keys, private key blocks, bearer headers, credentials in URLs and SECRET=, TOKEN=, PASSWORD= style assignments become [redacted]. The transcript file is Claude Code's own and Grid does not rewrite it.

Problem reports

Report a problem builds the mail on your machine. The screenshot never captures pixels: it walks the page and paints a bar of the same width over every text run, so layout and colours survive and no word does. That is structural rather than a setting, because the picture is geometry with no field a character could go in, and it holds however the rest of the report is written. The message text is yours to decide. It opens obfuscated: card and session values are replaced by blocks or left out, and recent actions carry hashed labels. Turning off Obfuscate everything sends those values and labels as written, which is what a report needs when the redacted one is unreadable to whoever receives it; the modal highlights every run going out in the clear and says on its face that the picture is bars either way. The switch is per report: it comes back on the next time the window opens, and nothing about it is stored. You read the payload, then copy it or open it in your mail client; the picture is saved by its own button and you attach it yourself.

Plugins

Every plugin runs in its own child process under Node's permission flags: reads limited to the engine, the plugin's own directory and the roots it declared, writes to the declared roots only, child processes only when the manifest declares shell. Network access is enforced by intercepting the HTTP modules, which binds an honest plugin only, and if Node refuses the flags the plugin starts without them and the log says enforcement is partial. Official plugins are Ed25519-signed and re-verified on every load against the files on disk; a tampered plugin is skipped, and an unsigned one is refused unless you turn on "Allow unverified plugins" in Settings. See plugins.

A plugin that declares permissions.spawn is an agent provider. Today that means claude-provider and copilot-provider, both of them plugins Grid ships and signs. Such a plugin is the one exception to that sandbox, by design: it names a real program that Grid runs OUTSIDE the plugin's fence, as you, with every right you have on the machine. None of the flags above confines it. That block rides in the signed manifest and is shown, in full, before install. A third-party plugin is then shown it again before Grid ever runs that binary the first time, resolved to the actual path on your machine, and a person has to say yes before the first session starts. Changing that plugin's bytes at all (the binary name, one argv flag, anything in the block) invalidates its approval and asks again. A plugin Grid itself built and signed is exempt from that first-run question, on the grounds that installing Grid already answered it: nobody is asked before claude-provider or copilot-provider starts a session, and what guards those is the Ed25519 signature re-derived from the bytes on disk, which a tampered plugin fails. See Adding a provider.

Builds and disclosure

Release builds are macOS on Apple silicon and Intel, Linux x64 AppImage, and Windows x64 NSIS installer. None is signed today: the macOS signing and notarisation code is complete but waits on Developer ID secrets, and the Linux and Windows artefacts ship unsigned, so Windows SmartScreen will warn on first run. Each release carries one SHASUMS256-<platform>-<arch>.txt per build as an asset. There is no SBOM.

Report vulnerabilities to security@gridconsole.dev. We acknowledge within two business days, aim to ship a fix within 30 days and coordinate disclosure at 90. The seller of record and the registration number are on the legal page; the full policy is on the security page.